{"schema_version":"0.10.0","id":"LR-2026-0838","record_version":1,"title":"Lovable AI-generated apps ship with unauthenticated Supabase databases exposing passport, payment and chat data","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":8.0,"unhedged_language":4.9},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-04","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Startup Fortune · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-04","history":[{"date":"2026-11-04","from_level":null,"to_level":"preliminary","reason":"1 report: Startup Fortune · subject to change"}]},"sources_hash":"7a91fdaccc3925a571da5ed15a79259b3534d2beb75bb58bbaf588b59b5c471a"},"system":{"model_name":null,"model_version":null,"developer":"Lovable","harness":"Lovable","tools_granted":["database_write","code_generation","deployment"],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":["automated Security Scanner","AI-driven Security Reviewer"],"deployment_context":"production","tier":null,"lifecycle_stage":"production","integration_type":"agentic_with_tools","intended_use":"describe an app in plain English and watch an AI agent build it, wire up a database and ship it live","safeguard_state":null,"production_intended":true},"event":{"date_occurred":null,"date_disclosed":"2026-11-02","incident_class":"privacy_leakage","failure_class":"silent_wrong_state","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Lovable, an AI coding platform whose agent builds apps, wires up a database and ships them live, generated thousands of apps whose Supabase backends returned records without authentication. The German research group Crissy Field, working with Handelsblatt, pulled 159,041 Lovable projects from Common Crawl covering apps built between December 2025 and September 2026 and queried their databases without credentials. Of 34,545 projects on Supabase, 24,664 returned records with zero authentication; email addresses were readable on 7,403 sites, one database exposed over 1,000 passport records, a forum leaked more than 200,000 chat messages and 80,000 profiles, and a CRM-style project exposed more than 280,000 customer emails. The findings point to an agent that, left to its defaults, generates working apps without enabling Row Level Security, despite Lovable's Security Scanner and AI-driven Security Reviewer added after CVE-2025-48757.","tags":["vibe-coding","coding-agent","data-exposure","supabase-rls","unauthenticated-database","pii","passport-data"],"date_detected":null,"near_miss":false,"root_cause":"guardrail","root_cause_detail":"The AI agent generating backend code left Supabase Row Level Security unconfigured by default, and Lovable's Security Scanner and AI-driven Security Reviewer did not catch the misconfiguration before apps shipped.","failure_class_detail":"The agent generated and shipped apps whose databases were left in an insecure, publicly readable state without flagging it; classified from the described behaviour as a silent wrong state rather than an injection or exfiltration mechanism.","responsible_party":"provider","adversarial_actor":"none","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":"A separate flaw tracked as CVE-2025-48757 led the company to add an automated Security Scanner and an AI-driven Security Reviewer meant to catch exactly this kind of misconfiguration before it ships."},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Major: many third parties' personal data was exposed at unbounded scope, with 24,664 projects returning records without authentication and one forum leaking more than 200,000 chat messages and 80,000 user profiles.","harm_class":["privacy"],"affected_description":"Thousands of vibe-coded apps reportedly exposed corporate and personal data on the open web.","protected_class_involved":null,"data_categories_exposed":["pii","credentials"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":24664},"evidence":{"sources":[{"url":"https://startupfortune.com/lovable-ai-apps-left-passport-and-payment-data-open-to-anyone/","publisher":"Startup Fortune","date":"2026-11-03","type":"press","title":"Lovable AI Apps Left Passport and Payment Data Open to Anyone - Startup Fortune","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.harness":"C","system.tools_granted":"C","system.autonomy_level":"D","system.guardrails_present":"C","system.deployment_context":"C","system.lifecycle_stage":"C","system.integration_type":"C","system.intended_use":"C","system.production_intended":"C","event.date_disclosed":"C","event.failure_class":"C","event.trigger":"D","event.detection_method":"C","event.summary":"C","event.tags":"C","event.near_miss":"C","event.root_cause":"C","event.root_cause_detail":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.precursor_events":"C","event.incident_class":"C","event.agent_involved":"C","event.failure_class_detail":"C","impact.severity":"C","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.downstream_exposure_count":"C","impact.severity_because":"C","context.industry":"C","context.country":"D","context.denominator_available":"C","context.denominator":"C","context.systemic_exposure":"C","context.incident_evidence":"C","context.coverage":"C"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Lovable markets itself as the tool that lets anyone, no engineer required, describe an app in plain English and watch an AI agent build it, wire up a database and ship it live."}],"system.harness":[{"source_index":0,"quote":"A German security firm scanned more than 159,000 apps built with the AI coding platform Lovable and found passport numbers, payment details and 200,000 private chat messages sitting in databases that needed no login to open."}],"system.tools_granted":[{"source_index":0,"quote":"Lovable markets itself as the tool that lets anyone, no engineer required, describe an app in plain English and watch an AI agent build it, wire up a database and ship it live."}],"system.guardrails_present":[{"source_index":0,"quote":"A separate flaw tracked as CVE-2025-48757 led the company to add an automated Security Scanner and an AI-driven Security Reviewer meant to catch exactly this kind of misconfiguration before it ships."}],"system.deployment_context":[{"source_index":0,"quote":"Of the 34,545 projects running on Supabase as their backend, 24,664 returned database records with zero authentication required."}],"system.lifecycle_stage":[{"source_index":0,"quote":"The team pulled 159,041 Lovable projects out of the Common Crawl web archive, covering apps built between December 2025 and September 2026, and checked what their databases would hand over to a stranger with no credentials at all."}],"system.integration_type":[{"source_index":0,"quote":"Lovable markets itself as the tool that lets anyone, no engineer required, describe an app in plain English and watch an AI agent build it, wire up a database and ship it live."}],"system.intended_use":[{"source_index":0,"quote":"Lovable markets itself as the tool that lets anyone, no engineer required, describe an app in plain English and watch an AI agent build it, wire up a database and ship it live."}],"system.production_intended":[{"source_index":0,"quote":"Lovable markets itself as the tool that lets anyone, no engineer required, describe an app in plain English and watch an AI agent build it, wire up a database and ship it live."}],"event.date_disclosed":[{"source_index":0,"quote":"That's the story behind a new scan from the German research group Crissy Field, working with the business daily Handelsblatt, first reported November 2."}],"event.failure_class":[{"source_index":0,"quote":"Crissy Field's findings point to an AI agent that, left to its own defaults, generates working apps without bothering to lock that door, while Supabase hands its public \"anon\" key broad read access unless someone actively restricts it."}],"event.detection_method":[{"source_index":0,"quote":"A German security firm scanned more than 159,000 apps built with the AI coding platform Lovable and found passport numbers, payment details and 200,000 private chat messages sitting in databases that needed no login to open."}],"event.summary":[{"source_index":0,"quote":"A German security firm scanned more than 159,000 apps built with the AI coding platform Lovable and found passport numbers, payment details and 200,000 private chat messages sitting in databases that needed no login to open."},{"source_index":0,"quote":"The team pulled 159,041 Lovable projects out of the Common Crawl web archive, covering apps built between December 2025 and September 2026, and checked what their databases would hand over to a stranger with no credentials at all."},{"source_index":0,"quote":"Of the 34,545 projects running on Supabase as their backend, 24,664 returned database records with zero authentication required."},{"source_index":0,"quote":"Email addresses alone showed up readable on 7,403 sites, spread across more than 10,500 tables."},{"source_index":0,"quote":"One service provider's database coughed up over 1,000 passport records complete with expiration dates and nationalities."},{"source_index":0,"quote":"A lifestyle forum built on Lovable leaked more than 200,000 chat messages and 80,000 user profiles to anyone who asked."},{"source_index":0,"quote":"One CRM-style project alone exposed more than 280,000 customer emails, waiting-list entries and support tickets."},{"source_index":0,"quote":"Crissy Field's findings point to an AI agent that, left to its own defaults, generates working apps without bothering to lock that door, while Supabase hands its public \"anon\" key broad read access unless someone actively restricts it."},{"source_index":0,"quote":"A separate flaw tracked as CVE-2025-48757 led the company to add an automated Security Scanner and an AI-driven Security Reviewer meant to catch exactly this kind of misconfiguration before it ships."}],"event.tags":[{"source_index":0,"quote":"Crissy Field's findings point to an AI agent that, left to its own defaults, generates working apps without bothering to lock that door, while Supabase hands its public \"anon\" key broad read access unless someone actively restricts it."},{"source_index":0,"quote":"Lovable markets itself as the tool that lets anyone, no engineer required, describe an app in plain English and watch an AI agent build it, wire up a database and ship it live."},{"source_index":0,"quote":"One service provider's database coughed up over 1,000 passport records complete with expiration dates and nationalities."}],"event.near_miss":[{"source_index":0,"quote":"Of the 34,545 projects running on Supabase as their backend, 24,664 returned database records with zero authentication required."}],"event.root_cause":[{"source_index":0,"quote":"Crissy Field's scan, conducted on apps built well after those tools existed, suggests they aren't catching enough of it."},{"source_index":0,"quote":"A warning that still lets 7,403 sites go live with open databases isn't a safeguard."}],"event.root_cause_detail":[{"source_index":0,"quote":"Crissy Field's findings point to an AI agent that, left to its own defaults, generates working apps without bothering to lock that door, while Supabase hands its public \"anon\" key broad read access unless someone actively restricts it."},{"source_index":0,"quote":"Crissy Field's scan, conducted on apps built well after those tools existed, suggests they aren't catching enough of it."}],"event.responsible_party":[{"source_index":0,"quote":"The responsibility for that gap sits with the platform that writes the code, not with the person who typed a sentence and trusted it to come back secure."}],"event.adversarial_actor":[{"source_index":0,"quote":"You don't need to hack anything when the door was never locked."}],"event.precursor_events":[{"source_index":0,"quote":"A separate flaw tracked as CVE-2025-48757 led the company to add an automated Security Scanner and an AI-driven Security Reviewer meant to catch exactly this kind of misconfiguration before it ships."}],"event.incident_class":[{"source_index":0,"quote":"A German security firm scanned more than 159,000 apps built with the AI coding platform Lovable and found passport numbers, payment details and 200,000 private chat messages sitting in databases that needed no login to open."}],"event.agent_involved":[{"source_index":0,"quote":"Lovable markets itself as the tool that lets anyone, no engineer required, describe an app in plain English and watch an AI agent build it, wire up a database and ship it live."}],"event.failure_class_detail":[{"source_index":0,"quote":"Crissy Field's findings point to an AI agent that, left to its own defaults, generates working apps without bothering to lock that door, while Supabase hands its public \"anon\" key broad read access unless someone actively restricts it."}],"impact.severity":[{"source_index":0,"quote":"Of the 34,545 projects running on Supabase as their backend, 24,664 returned database records with zero authentication required."},{"source_index":0,"quote":"A lifestyle forum built on Lovable leaked more than 200,000 chat messages and 80,000 user profiles to anyone who asked."}],"impact.harm_class":[{"source_index":0,"quote":"One service provider's database coughed up over 1,000 passport records complete with expiration dates and nationalities."}],"impact.affected_description":[{"source_index":0,"quote":"Thousands of vibe-coded apps reportedly exposed corporate and personal data on the open web."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"One service provider's database coughed up over 1,000 passport records complete with expiration dates and nationalities."},{"source_index":0,"quote":"Crissy Field's scan turned up tens of thousands of ticket bookings and restaurant orders carrying home addresses and payment information, plus AI-generated email summaries, contracts, invoices and WhatsApp logs sitting in business tools built the same way."}],"impact.downstream_exposure_count":[{"source_index":0,"quote":"Of the 34,545 projects running on Supabase as their backend, 24,664 returned database records with zero authentication required."}],"impact.severity_because":[{"source_index":0,"quote":"Of the 34,545 projects running on Supabase as their backend, 24,664 returned database records with zero authentication required."},{"source_index":0,"quote":"A lifestyle forum built on Lovable leaked more than 200,000 chat messages and 80,000 user profiles to anyone who asked."}],"context.industry":[{"source_index":0,"quote":"Lovable markets itself as the tool that lets anyone, no engineer required, describe an app in plain English and watch an AI agent build it, wire up a database and ship it live."}],"context.denominator_available":[{"source_index":0,"quote":"The team pulled 159,041 Lovable projects out of the Common Crawl web archive, covering apps built between December 2025 and September 2026, and checked what their databases would hand over to a stranger with no credentials at all."}],"context.denominator":[{"source_index":0,"quote":"The team pulled 159,041 Lovable projects out of the Common Crawl web archive, covering apps built between December 2025 and September 2026, and checked what their databases would hand over to a stranger with no credentials at all."}],"context.systemic_exposure":[{"source_index":0,"quote":"Every one of those 7,403 exposed sites was built by a different person typing a different prompt, yet they converged on the identical failure, because the AI model generating their backend code converged on it first."}],"context.incident_evidence":[{"source_index":0,"quote":"That's the story behind a new scan from the German research group Crissy Field, working with the business daily Handelsblatt, first reported November 2."}],"context.coverage":[{"source_index":0,"quote":"The responsibility for that gap sits with the platform that writes the code, not with the person who typed a sentence and trusted it to come back secure."}]},"notes_on_gaps":"The article gives no model name or version for the Lovable agent, no autonomy/approval arrangement, no occurrence date (only the scan window December 2025 to September 2026 and disclosure on 2026-11-02), no total records-exposed figure, no monetary loss, and no remediation or containment timeline. impact.records_exposed left null because the article gives per-incident counts (1,000+ passports, 200,000 chat messages, 80,000 profiles, 280,000 emails) but no aggregate. impact.downstream_exposure_count uses the 24,664 unauthenticated Supabase projects as the closest stated scope figure. Country left unknown: the researchers are German and Handelsblatt is German, but the operator Lovable's jurisdiction is not stated. failure_class silent_wrong_state is a grade-D classification from described behaviour (agent shipped apps with databases left open); trigger left unknown because no source names a cause. control_failure left empty because the article describes the Security Scanner/Reviewer as insufficient rather than naming a specific safeguard that was absent or bypassed in a stated way. Extractor proposed values without quotes; dropped: ['context.country', 'event.trigger', 'impact.reversibility', 'system.autonomy_level', 'system.tier']. Single secondary source; corroborate before upgrading any field to B. [2026-11-04: evidence level set: Preliminary (1 report: Startup Fortune · subject to change)]"},"context":{"industry":"Software Publishers","org_size_band":null,"country":"unknown","denominator_available":true,"denominator":{"value":159041.0,"unit":"other","period":"December 2025 to September 2026"},"related_incident_ids":[],"systemic_exposure":true,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":{"log_completeness":null,"tamper_evidence":null,"timestamp_reliability":"unknown","investigation_independence":"unpaid_independent","redaction_summary":null,"analysis_method":"human_review","prompt_output_retention":null},"regulatory":null,"coverage":{"responding_lines":["cyber","privacy/liability"],"posture":"novel","notes":"Loss falls on third-party data subjects whose records sat in unauthenticated databases generated by the platform's agent; allocation between platform provider and app builders is contested in the article."}}}